ApplnNo. 10/780,098 

Amendment dated March 30, 2009 

Reply to Office Action of December 30, 2008 

Docket No. BOC9-2003-0087 (458) 

REMARKS/ARGUMENTS 

These remarks are made in response to the Office Action of December 30, 2008 
(Office Action). As this response is timely filed within the 3 -month shortened statutory 
period, no fee is believed due. However, the Examiner is expressly authorized to charge 
any deficiencies to Deposit Account No. 14-1437. 

Claims Rejections - 35 USC $ 103 

Claims 1-4 were rejected under 35 U.S.C. § 103(a) as being unpatentable over 
U.S. Patent 6,988,075 to Hacker, et al (hereinafter Hacker) in view of non-patent 
literature, "Public Standards and Patients' Control: How to Keep Electronic Medical 
Records Accessible but Private," BMJ, Feb. 2001; 322, pages 283-287 to Mandl, et al. 
(hereinafter Mandl). Claims 16-18 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Hacker in view of Mandl, and further in view of U.S. Published Patent 
Application 2002/0010679 to Felsher (hereinafter Felsher). 

Applicants respectfully disagree with the rejections and thus have not amended the 
claims. Applicants have added Claims 20-27. The added claims are fully supported by 
the original disclosure and no new matter has been introduced. 

Aspects of Applicants ' Invention 

It may be helpful to reiterate certain aspects recited in the claims prior to 
addressing the cited references. One aspect of the invention, as typified by Claim 1, is a 
method of permitting controlled access to medical information of a patient. 

The method can include establishing a storage means for storing the medical 
information of the patient; establishing a means for accessing the medical information by 
the patient or any other authorized user; controlling an authorization and a scope of 
access to the medical information by the patient according to a role of a user accessing 
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the medical information by modifying an access control list. The access control list, 
more particularly, can list all authorized users and their respective roles. 

The method also can include assigning each user with a unique ID and pin, and 
tracking and notifying the patient of an identity of an entity that accessed the medical 
information, information that was accessed by the entity, and when the entity accessed 
the information. 

See, e.g., Specification, paragraphs [0008], [0023], and [0035]. 

The Claims Define Over The Prior Art 

It was asserted in the first paragraph on page 6 of the Office Action that Hacker 
teaches providing the provider with appropriate means for input of the unique access 
identification for patient identification and access along with unique passphrases (i.e. pin) 
to access the patient information (Hacker: col. 7, 60-66). 

Col. 7, lines 60-66 of Hacker reads: 

Appropriate means for input of the unique access identification means, 
such as bar code readers (BCRs) 160 for bar coded cards and bracelets, 
can be used for patient identification and access. Particularly sensitive 
patient information can be passphrase protected so that the medical 
provider must get permission from the patient to gain access to it. 

As can be seen from the above paragraph, in Hacker the unique access 
identification means is used for patient identification and is thus unique to the patient. 
The passphrase is used to get permission from the patient to gain access to sensitive 
patient information. Therefore, in Hacker both the access identification means and the 
passphrase are unique to the patient whose information is being accessed. In contrast, in 
the present invention, the ID and the pin are unique to the user who is trying to access the 
patient information. 
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It was asserted in the second paragraph on page 6 of the Office Action that Mandl 
discloses the patient having preferences about different parts of his/her medical history by 
providing authorization independently; furthermore teachings that patients grant different 
access rights to different providers based on their role and on the particular individual 
(Mandl: p. 284; section Confidentiality). 

However, as already discussed in the previous response, although Mandl mentions 
that the patient can limit the information to specific providers and provides an override 
mechanism that is controlled by the patient, Mandl does not suggest using an access 
control list as the mechanism for controlling access. It is noted that granting different 
access rights to different providers based on their role is not the same as using an access 
control list as the mechanism for controlling access. The former is the result and the 
latter is the tool to achieve the result. 

The other cited references do not make up for the deficiencies of Hacker in view 
of mandl. 

Accordingly, the cited references, alone or in combination, fail to disclose or 
suggest each and every element of Claims 1, 20, and 24. Applicants therefore 
respectfully submit that Claims 1, 20, and 24 define over the prior art. Furthermore, as 
each of the remaining claims depends from Claims 1, 20, or 24 while reciting additional 
features, Applicants further respectfully submit that the remaining claims likewise define 
over the prior art. 

Applicants thus respectfully request that the claim rejections under 35 U.S.C. § 
103 be withdrawn. 
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CONCLUSION 

Applicants believe that this application is now in full condition for allowance, 
which action is respectfully requested. Applicants request that the Examiner call the 
undersigned if clarification is needed on any matter within this Amendment, or if the 
Examiner believes a telephone interview would expedite the prosecution of the subject 
application to completion. 

Respectfully submitted, 

NOVAK DRUCE + QUIGG LLP 

Date: March 30, 2009 /Gregory A. Nelson/ 

Gregory A. Nelson, Registration No. 30,577 
Yonghong Chen, Registration No. 56,150 
Customer No. 40987 
CityPlace Tower 

525 Okeechobee Blvd., Fifteenth Floor 
West Palm Beach, FL 33401 
Telephone: 561.838.5229 
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